The Toy Ghouls backdoor hides C2 traffic in HiveMQ MQTT and Element messenger. See how the Bearlyfy group's custom malware works.
Related Posts:
The post Toy Ghouls Backdoor Uses HiveMQ and Element for C2 appeared first on Daily CyberSecurity.
VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.
Related Posts:
The post ZBT Router Backdoor: VulnCheck Sinkholes SPEAKINGSTONE and DARKLANTERN Implants appeared first on Daily CyberSecurity.
Zscaler details the C2Looper backdoor, a Rust backdoor tied to ransomware that uses GitHub for C2 and likely spreads through ClickFix lures.
Related Posts:
The post C2Looper: Rust Backdoor Uses GitHub for C2 Control appeared first on Daily CyberSecurity.
Seqrite links Operation QUICSILVER to a China-nexus actor deploying the QUICAgent Go backdoor against Myanmar government targets via a VHD lure.
Related Posts:
The post Operation QUICSILVER Targets Myanmar Government With Go Backdoor appeared first on Daily CyberSecurity.
GEEKOM's official site served backdoored AMD mini PC drivers since December 2024 via a compromised legacy support page still indexed by Google.
Related Posts:
The post GEEKOM Mini PC Driver Downloads Found Bundled With Backdoor Since 2024 appeared first on Daily CyberSecurity.
Resecurity (USA) estimated the most affected sectors by the “SANDCLOCK” backdoor, which was planted as a result of the code repository compromise. According to cybersecurity experts, LiteLLM / TeamPCP Supply-Chain Attack will have long-lasting consequences.
By compromising a well-known component in AI applications, adversaries will multiply the blast radius—some of the victim organizations are still unaware of the backdoor and its impact. LiteLLM is a popular open-soure AI gateway and utility library that unifies API calls for over 100 large language model providers, such as OpenAI, Anthropic, Google Gemini, and local Ollama models.
Such incidents involve substantial MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond). The threat actor group “TeamPCP” compromised maintainer credentials for LiteLLM and published malicious package versions 1.82.7 and 1.82.8 to PyPI around March 2026 – creating a window of exposure lasting at least a few months.
Over 2,500+ organizations and hundreds of thousands of CI/CD environments suffered full-credential exposure, compromising cloud infrastructure keys, repository access tokens, SSH credentials, Kubernetes secrets, and AI provider API keys (such as OpenAI and Anthropic).
Resecurity has acquired the 150GB archive attributed to the LiteLLM supply-chain attack conducted by TeamPCP using the “SANDCLOCK” credential-stealer. Per published incident reporting — accompanying victim manifests enumerate 898 compromised GitHub owners (organisations/accounts) across 2,038 repositories. The affected owners include major global enterprises — among them Microsoft, Azure, IBM, NVIDIA, PayPal (Zettle), Deloitte, Bosch, S&P Global, Elevance Health, 84.51° (Kroger), Adeo (Leroy Merlin), Kärcher, Dräger, ID.me and 1inch.
Top 10 the most impacted sectors (by victim organization profile):
Resecurity enumerated 2,146 records by key name (values never inspected beyond structural masking). The composition is overwhelmingly GitHub CI-CD identity material, with a long tail of high-value cloud and registry credentials.
Victim manifests (owners.txt, repos.txt) enumerate 898 distinct compromised GitHub owners across 2,038 repositories. The distribution is long-tailed: 631 owners have a single affected repo, while the most-affected owner (Cencosud-Cencommerce) has 64. Critically, the owner list includes major global enterprises and regulated organisations.
Every organization affected by the LiteLLM incident should revoke or rotate GitHub App private keys, PATs, AWS/GCP/Firebase credentials, ECR/JFrog tokens, SSH keys, and signing passwords, and invalidate sessions.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
A Head Mare TrueConf attack chains two zero-days to install the PhantomCore backdoor via a trojanized client.
Related Posts:
The post Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor appeared first on Daily CyberSecurity.
Researchers at Acronis just documented an espionage operation that reads like it was built by someone with genuinely good taste in disguises. Their Threat Research Unit report tracks a previously undocumented backdoor called PATCHCORD, hitting Afghan telecom providers and South Asian critical infrastructure through fake VPN installers and management tools branded to look exactly like the real thing.
“Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools.” reads the Acronis’s report. “Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD’s capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India’s National Informatics Centre (NIC).”
The delivery method leans hard into specificity. One installer impersonated Afghan Telecom down to matching the company name, product fields, and even the URL of the real support portal customers actually use, the kind of detail that only comes from someone who studied the target closely rather than mass-producing generic lures. Click through it, and a 64-bit Windows implant quietly installs itself while a real browser session opens normally in the background, so nothing looks wrong to the person who just got infected.
PATCHCORD’s persistence trick is worth pausing on because it’s genuinely sneaky. Instead of the usual registry-only approach, it hijacks the actual shortcut files for Edge, Chrome, and Firefox, backing up the originals and rewriting them to launch the malware first, silently starting the real browser afterward so the shortcut still works exactly as expected.
“PATCHCORD establishes persistence by hijacking browser shortcuts. Before modifying shortcuts, the implant checks whether it is running with elevated privileges and then attempts to hijack shortcuts for Microsoft Edge, Google Chrome and Mozilla Firefox.Browser identifier and executable-name mapping.” continues the report.
“The implant searches for shortcuts associated with Microsoft Edge, Google Chrome and Mozilla Firefox before attempting to hijack them.”
Every time someone clicks their browser icon, the malware runs invisibly in the background before the browser they wanted even opens.
Once installed, PATCHCORD checks in with its command server and waits for instructions, supporting five core capabilities: adjusting how often it phones home, listing running processes, executing shellcode entirely in memory, running arbitrary commands through a hidden shell, and controlling its own browser-hijacking persistence remotely. The in-memory shellcode execution is the standout feature here, since the payload never touches disk at any point, which keeps forensic evidence to a minimum for anyone investigating after the fact.
Pivoting off the infrastructure led researchers to a second, more evolved implant they’re calling SHEETCORD, written in Go and delivered through a domain impersonating India’s National Informatics Centre.
“The Go-based malware combines functionality previously observed in the SHEETCREEP RAT with several capabilities introduced in PATCHCORD, suggesting an evolution of the operator’s tooling.SHEETCORD executing shell command function.” states Acronis.
“The implant implements a remote command execution capability main.executeShellCommand similar to PATCHCORD. However, instead of invoking cmd.exe /c, it executes commands through powershell -Command with script block wrapping, suggesting an evolution of the operator’s tooling.”
This one drops the traditional web server entirely and instead uses the Google Sheets API for command and control, creating a dedicated spreadsheet tab for each victim to send and receive instructions. Hiding malicious traffic inside a service as mundane as Google Sheets is a clever way to blend in with normal corporate network traffic that nobody thinks twice about.
The researchers also found a third malware family, HACKERAI C2 Agent, that uses GitHub Gists for the same purpose and shows clear signs of having been built with AI coding assistance. Acronis pointed to leftover debug messages, AI-style code comments, and a redundant double-XOR routine using the same key twice as tells.
“The implant contains code comments and implementation patterns consistent with AI-assisted code generation. Together, these observations suggest that the malware was developed, at least in part, using LLM-assisted coding tools.” the researchers state.
Threat actors are actually using generative AI in practice, not only for some dramatic autonomous hacking campaign, but just as an ordinary coding shortcut.
What really opened the investigation up was an exposed staging server the operator left unsecured. It contained the operator’s entire toolkit laid bare: SuperShell, a Chinese-language command-and-control framework, multiple remote access trojan frameworks, credential-harvesting tools, exploit code for a known OpenSSH vulnerability, and files that appear to follow an iOS call history database format, hinting the group may have also pulled data off mobile devices. Finding a threat actor’s actual staging server is rare, and it’s the kind of mistake that turns a hard-to-attribute campaign into a much clearer picture very quickly.
Acronis links this activity to APT36, also known as Transparent Tribe, a threat group with a documented history of targeting Indian government and defense organizations, though the researchers rate the connection at moderate rather than full confidence. The reasoning holds up: matching credential-harvesting tools previously seen in confirmed APT36 campaigns, a shared C2 framework independently attributed to the same group by other researchers, and a Google Sheets technique closely resembling an earlier documented campaign already linked to the same actor. None of these signals alone would be conclusive, but stacked together they paint a consistent picture rather than a coincidence.
The infrastructure was still live at the time of publication, with domains steadily rotating while the underlying server stayed the same for months. If your organization touches Afghan telecom operations, Indian government systems, or South Asian energy infrastructure, this is exactly the kind of report worth forwarding to whoever handles phishing awareness training, because the lures here are good enough that “just don’t click suspicious links” isn’t much of a defense on its own.
“The PATCHCORD campaign demonstrates an evolving espionage operation targeting telecom, government, defense, and critical infrastructure organizations across South Asia. The discovery of PATCHCORD, SHEETCORD, and HACKERAI C2 Agent highlights the operator’s continued evolution, from a custom C/C++ backdoor to Go-based implants that abuse legitimate cloud services, including Google Sheets and GitHub Gists, for command-and-control.” concludes the report.
“The exposed staging server and related infrastructure provided valuable insight into the operator’s tooling, campaign development, and operational practices, enabling the identification of additional infrastructure and previously undocumented malware.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, PATCHCORD)
CVE-2026-66747: a Zbtlink router backdoor named ENDLESSDOORS gives unauthenticated remote code execution as root. No fix exists. CVSS 9.8.
Related Posts:
The post CVE-2026-66747: Zbtlink Router Backdoor ENDLESSDOORS Enables Unauthenticated Remote Code Execution as Root appeared first on Daily CyberSecurity.
Jacob Baines had a router on his desk that kept trying to call home, and it wasn’t supposed to. VulnCheck researchers found a backdoor baked into Zbtlink routers, and it’s not the kind of flaw you patch with an update. It’s a feature the vendor built in on purpose and shipped anyway.
Zbtlink is a Chinese manufacturer, Shenzhen Zhibotong Electronics, that builds routers and white-labels them under names like Wiflyer, ZBT, and ZBTWiFi, selling the same hardware on Amazon, Alibaba, and Shopify. The researchers bought a Zbtlink AX3000 off Alibaba and found something hiding in the process list disguised as a kernel thread.
Two processes named “kworker” were running as root with real memory footprints, sitting right next to the legitimate kernel threads that share the same name, betting nobody would look twice.
Those two processes are what Baines calls ENDLESSDOORS, built around a tiny open-source tool called rctl that nobody had touched since it was uploaded to GitHub back in 2015.
“A kworker is a Linux kernel thread, and it shows up in a process listing wrapped in brackets. The two unbracketed kworkers in the snippet above, from our AX3000, are not kernel threads.” reads the report published by VulnCheck. “They are ordinary userland processes running as root, with real memory footprints, named to disappear into a crowd of legitimate ones. They are an implant, a phone-home trojan horse. Our zero-day research team named this ENDLESSDOORS.”
The implant phones home to a hardcoded server, and once it connects, there’s essentially no security checking who’s on the other end. As Baines put it, “there is no handshake, no key exchange, no negotiation” before the router hands over control.
“When the implant reaches a server, it sends a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address. That’s the whole registration. There is no client or server verification.
After that, anything the server sends is handed to popen() and executed as uid 0. There is no allow-list and no sandbox. One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. That is a live interactive root shell.” continues the report. “The vocabulary of this protocol is two phrases: run this as root, and give me a root shell.”
That last part is the whole vulnerability in one sentence. Once connected, anything the command server sends gets executed as root through a basic system call, no allow-list, no sandbox, nothing filtering what commands are acceptable. One specific string even tells the router to open a second connection and hand back a live interactive root shell, essentially a remote login with no password required.
Because the router dials out instead of listening for connections, none of the usual firewall logic helps. A unit sitting behind three layers of corporate firewall is just as exposed as one sitting on the open internet, as long as it can reach the command server somehow. VulnCheck proved this wasn’t theoretical by writing their own tool that impersonated the command server, catching the router’s outbound connection and getting a root shell back in under two seconds.
The researchers pointed out that twenty different router models carry the same backdoor, all of them starting it automatically at boot through an init script named skworker. VulnCheck found the whole fleet dialing out to just four addresses total, hosted across Alibaba Cloud, Vultr, and a Chinese cloud provider, meaning whoever controls those servers controls every affected router in the world simultaneously.
The affected router dials the same tiny set of endpoints. The researchers noted that across all the impacted models it reduces to four primary and secondary endpoints:
| Role | Endpoint | Resolves to | Hosting |
|---|---|---|---|
| Primary | zbtctl.epplink[.]net | 47.100.190[.]96 | Alibaba Cloud, Shanghai |
| Primary | hardcoded IP | 47.107.224[.]89 | Alibaba Cloud, Shenzhen |
| Secondary | online-string.com | 45.32.81[.]152 | Vultr |
| Secondary | rbdg4nzqadui[.]wikaba[.]com | 43.248.136[.]125 | Jiangsu Dongyun Cloud |
VulnCheck skipped the usual courtesy of privately warning the vendor before going public, and explained exactly why. Coordinated disclosure assumes a vendor didn’t mean to ship the flaw, and that assumption didn’t hold here: this was a vendor-built component, started by the vendor’s own boot script, present across two dozen models and years of firmware releases. Warning the company that built it on purpose, in VulnCheck’s view, would only tip off whoever’s running that infrastructure.
Zbtlink said the backdoor was intended only for after-sales maintenance and not present in production devices. However, the company also removed firmware downloads and acknowledged unspecified firmware security vulnerabilities, raising further questions about its explanation.
“This feature is solely intended for after‑sales maintenance and serves no other purposes,” a company spokesman told The Register. “It is generally retained only on sample units to assist customers with software debugging and will not be included in mass‑production shipments.”
There’s no patch coming for any of this, so the fix isn’t waiting around, it’s treating every affected device as compromised by design. Check your model number against the list of twenty, not the brand printed on the case, since the same hardware gets relabeled under multiple names. If you find the backdoor, block the four known command servers at your firewall, and if the router handles anything that actually matters, replace it rather than trust a company that just got caught lying about what it shipped.
“There is no fixed firmware. Treat this as a device-trust problem, not a patching problem.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Backdoor)
Symantec’s Threat Hunter Team found Daxin running on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer in 2026. Daxin is a Windows kernel-mode rootkit that Symantec first documented in March 2022, with evidence of use in targeted attacks against governments and critical infrastructure dating back to 2013.
“Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational.” reads the report published by Symantec. “It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered.”
The same machine also carried a previously unreported backdoor, which the researchers are tracking as Stupig. Both artifacts carry compilation timestamps from early 2013. Telemetry from the machine only started appearing on May 12, 2026. The implication is that this intrusion may have gone undetected for thirteen years.
Neither of these is a new tool in the sense that they were recently written. What’s new is that they’re still in use, still operational, and apparently were never removed from at least this one network. Thirteen years is a long time to be inside someone’s infrastructure without anyone noticing.
Daxin is implemented as a Windows kernel driver, a rare choice for malware authors. The malware implements advanced communication capabilities that allow the attackers to communicate with infected computers on highly secured networks, where direct internet connectivity is not available.
The malware can hide its traffic in normal network traffic on the target’s network and abuse legitimate services already running on the infected computers.
Daxin doesn’t reach out to attacker-controlled servers the way most malware does. Instead, it monitors incoming TCP traffic on the host for specific patterns and hijacks existing legitimate connections to run its encrypted communications, blending in with traffic that’s already there.
“Rather than establishing its own outbound connections, the driver monitors incoming TCP traffic for specific patterns and hijacks existing legitimate connections to carry encrypted command-and-control (C&C) traffic.” states Symantec. “This made Daxin exceptionally difficult to identify with conventional network monitoring. “
That multi-hop capability is significant: it means the operator can reach machines that have no direct internet connection by routing commands through a chain of compromised machines that do. Standard network monitoring looking for outbound connections to suspicious destinations would find nothing.
Stupig disguises itself as kbdus1.dll, mimicking the legitimate kbdus.dll file that Windows uses for the U.S. English keyboard layout. It registers itself as a keyboard-layout provider, which causes win32k.sys to load it into winlogon.exe at system startup.
“Backdoor.Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.” the Symantec team explains. “The DLL returns a valid KBDTABLES pointer so the keyboard layout functions normally, giving nothing away to any process or administrator inspecting the loaded module.”
The keyboard works perfectly. Nothing looks wrong. The backdoor is just sitting there, loaded into the Windows login process.
Once it’s running inside winlogon.exe, Stupig watches the Windows login screen for usernames that begin with the string “stupig.” Whatever follows that prefix is treated as a command and executed with SYSTEM privileges, which is the highest level of access on a Windows machine. If someone types the prefix with nothing after it, the backdoor opens a command prompt with SYSTEM privileges directly on the login screen, before any user has authenticated.
“Stupig uses a technique not documented in any known malware family. A Trojanized keyboard-layout DLL loaded by winlogon.exe lets an attacker run commands as System directly from the Windows logon screen, before anyone signs in and without raising a logon audit event.” continues the report.
No login event is logged. No audit trail. A defender monitoring authentication logs would see nothing.
The experts still have to discover how the host was originally compromised. The most likely entry point, based on what was found, is an outdated version of the Digiwin single sign-on portal that was running end-of-life Java Development Kit versions 1.5 and 1.6, software from 2009 to 2011. That’s a significant attack surface left exposed on a network belonging to a subsidiary of a multinational manufacturer.
Symantec hasn’t found code-level overlap between Daxin and Stupig, so there’s no technical proof they came from the same development team. What connects them is deployment on the same host, complementary functions, similar development practices, and identical 2013 compile timestamps. One tool handles deep network persistence and covert communications. The other provides pre-authentication SYSTEM access through a mechanism most security teams aren’t monitoring.
“If linked to the same actor, the Stupig backdoor adds a further capability.” concludes the report. “By hiding inside the Windows logon process and registering as a keyboard-layout provider, Stupig gives operators SYSTEM-level command execution and credential theft before a user signs in, an access method most defenders are not aware of nor watching for. Whether the same operators deployed both tools cannot be confirmed, but their functions are complementary.”
The practical upshot for defenders is to add keyboard-layout DLL loading to the list of things worth monitoring, particularly anything being loaded into winlogon.exe at startup that wasn’t there before. The Windows login process is not a place most security teams look for malicious activity, which is precisely why this works.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Daxin rootkit)
In October 2025, Microsoft’s threat intelligence team identified destructive wiping activity inside compromised environments and traced it to a previously unknown piece of malware they’re now calling GigaWiper. The malicious code is written in Go, it combines a command-and-control backdoor with multiple built-in destruction capabilities, and it was assembled by taking code from at least three older malware families and merging them into one implant. Efficient, if attackers aim at destroying the target systems.
“The consolidation of multiple destructive capabilities into a modular backdoor reflects a notable shift in wiper malware, which are typically designed purely to destroy rather than to extort and carry real-world consequences.” reads the report published by Microsoft. “GigaWiper exemplifies threat actors investing in operational efficiency, merging standalone tools into unified platforms that reduce their deployment footprint while expanding their destructive capabilities.”
The backdoor communicates with its operators over RabbitMQ for receiving commands and Redis for sending back results. It persists through a scheduled task named “OneDrive Update” that runs every minute and at system startup, and tracks its own execution count in a registry key disguised as a OneDrive entry. The command set runs from 1 to 20 and covers an unusually wide range of capabilities for a single implant.
The destructive commands are the most interesting features. Command 1 wipes physical disks at the raw level, overwriting content in chunks and removing partition metadata from non-Windows drives before forcing a reboot. Command 2 triggers a Blue Screen of Death and prevents the machine from starting again by deleting critical boot and kernel files. Command 3 encrypts files with a randomly generated key that is never saved anywhere, renames them with a .candy extension, and drops a threatening image as the wallpaper.
The researcher pointed out that there’s no ransom note and no way to recover the files, because the actor never intended to offer decryption. Command 12 performs a more thorough multi-pass wipe of just the Windows installation drive, overwriting it with zeros, 0xFF values, and random bytes across multiple passes.
Beyond destruction, the backdoor includes a full remote-control suite. Command 20 opens a VNC-style remote desktop session over TCP with keyboard and mouse control, creating firewall rules named after legitimate Windows components to hide the traffic. Commands 9 and 10 handle screenshots and continuous screen recording when the user is active. Commands 15 through 18 manage system information collection, process control, service management, and registry navigation in a way that maintains session state between requests, essentially providing an interactive registry browser. Command 19 wipes Windows event logs, attempting to delete Security logs twice using different methods if the first fails, and for unknown reasons ends by printing the string “kharbvnmhkjbkjb” to the console.
The architectural story is what makes GigaWiper technically interesting. Microsoft identified that each of the three main destructive commands traces back to a separate, previously existing malware family developed by the same threat actor.
Command 3, the fake ransomware, is built on Crucio ransomware code. Crucio was documented in a CISA advisory in December 2023. The function BigBangExtortMain, which handles the file encryption in GigaWiper, shares its name and logic with the same function in Crucio.
“GigaWiper backdoor command 3 is heavily based on Crucio’s code, leading to the assessment that the same threat actor developed both malware families.” states Microsoft.
Command 12, the multi-pass secure wipe, is a Go reimplementation of FlockWiper, a C-based wiper that first appeared on VirusTotal in June 2025, several months before GigaWiper was observed. The logic and strings are nearly identical between the two, with GigaWiper’s version appearing to be a more updated iteration. FlockWiper’s compiled binaries contain program database paths referencing the string “GRAT,” and that same string appears repeatedly in GigaWiper’s function names, providing an additional thread connecting the two families.
“The name “GRAT” is also prevalent in several function names within the GigaWiper backdoor.” continues the report, “Although the FlockWiper binaries do not include “GRAT” functionality, the PDB paths provide another link between the two malware families.”
The string suggests the possible existence of a related framework or component that hasn’t been recovered yet.
Command 1, the standalone disk wiper, appears in GigaWiper as an exact replica of the standalone wiper binary Microsoft also observed being deployed separately. The function names and code flow are identical; the standalone wiper’s main routine simply reappears inside the backdoor as a callable command.
The modular structure changes what defenders need to think about. A traditional wiper gets deployed, runs, and destroys. GigaWiper sits on a system, maintains persistence, communicates back to operators, and can switch between quiet intelligence-gathering and full destruction on command, without requiring the attacker to deploy a new tool. The same implant that takes screenshots and manages processes today can wipe disks tomorrow.
The C2 infrastructure observed in samples used 185.182.193[.]21 on port 5544 for RabbitMQ command delivery and port 7542 for Redis result reporting. The RabbitMQ fanout exchange named “All” broadcasts commands to every infected host simultaneously, while a topic exchange named “Topic” enables targeted commands to specific machines.
“GigaWiper is a backdoor with extensive operational capabilities that allow a threat actor to maintain control over infected systems, execute commands, deploy additional tooling, and ultimately trigger one of multiple destructive commands on demand. It allows the threat actor to operate with flexibility, enabling both quiet espionage activity and destructive wiping operations.” concludes the report. “Overall, these findings show the evolution of the actor’s tooling over time. Functionality was merged into a single robust backdoor, granting the actor more ways to control and destroy infected systems.”
Microsoft’s recommended mitigations focus on preventing the defense-disabling steps that wipers typically rely on: enabling tamper protection to stop attackers from turning off security services, running endpoint detection and response in block mode, and enabling cloud-delivered protection to catch rapidly evolving tools. Blocking direct access to the known C2 infrastructure at 185.182.193[.]21 is the immediate network-level action available to organizations that can act on the published indicators.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)
Palo Alto Networks Unit 42 researchers published a detailed report on a Chinese-speaking threat actor, tracked as CL-STA-1062, that has been running persistent operations across East Asia since at least March 2022 and shifted focus to Southeast Asian government entities and state-owned critical energy infrastructure from mid-2025 onward.
The same group was previously flagged by Cisco Talos as UAT-7237, linked to campaigns against web hosting infrastructure in Taiwan. Between October and December 2025 alone, Unit 42 detected breaches at a minimum of ten different organizations in the region.
The intrusion pattern is consistent across targets. The attackers get in through ASPX web shells deployed against vulnerable web applications, use those shells for reconnaissance and tool delivery, and then establish persistent tunneling infrastructure using SoftEther VPN, Yuze, and VNT, all disguised as VMware executables or XDR agents with names like vmtools.exe, vmwared.exe, and XDRAgent.exe.
“From a technical standpoint, the attackers behind CL-STA-1062 rely on a hybrid toolkit.” reads the report published by Unit42. “While they frequently use common open-source tools such as SoftEther VPN, Mimikatz, and VNT, they have recently introduced TinyRCT, a bespoke, previously undocumented backdoor.”
In September 2025, Unit 42 observed the group compromise a Southeast Asian government entity, deploy a web shell, and exfiltrate data from an MS SQL server. During the same intrusion, they conducted network reconnaissance against a separate government entity in the same country, mapping potential lateral movement paths using traceroute.
“During this intrusion, the attackers were also able to conduct network reconnaissance on a separate government entity in the same country. This suggests an effort to identify lateral movement opportunities and broaden their access.” continues the report. “In one case, we observed the attacker staging and exfiltrating an entire directory of web server source code from the government entity”
Attackers leverage known open-source tools, such as JuicyPotato, to achieve privilege escalation. Stolen data was compressed into password-protected RAR archives before exfiltration.
TinyRCT is the technically interesting addition to this campaign. Unit 42 found it hosted on attacker infrastructure at 139.180.134[.]221 under the filename PerfWatson2.exe, a name chosen to mimic the legitimate Microsoft Visual Studio telemetry component.
It’s a lightweight C# backdoor that runs arbitrary commands via cmd.exe, enumerates directories and files, reads and exfiltrates files in 40KB gzip-compressed AES-encrypted chunks, captures screenshots as JPEG, downloads files from URLs, and deletes itself on command. The C2 address is hardcoded at 45.32.113[.]172, communicating over plain HTTP with AES-128 CBC encryption using a hardcoded key: ThisIsASecretKey87654321. The default polling interval is 10 seconds.
TinyRCT does two things to avoid analysts. On launch, it checks that it’s running from %LOCALAPPDATA%. If not, it terminates immediately. The code contains a line in Simplified Chinese inside the C2 response parsing function, a detail that points directly at the language background of whoever wrote it. The self-destruct routine uses choice.exe to introduce a three-second delay before deleting the primary executable, ensuring the process has fully exited and released its file handle before the deletion command runs. It also removes the persistence scheduled task it created on the way in.
Delivery comes via chrome_setup.zip, an archive containing three files: a legitimate signed chrome_setup.exe, a malicious chrome_setup.exe.config configuration file, and a rogue DLL named MyAppDomainManager.dll. When the user runs the legitimate executable, the .NET runtime reads the adjacent config file and loads the malicious DLL as the application domain manager, executing within the context of a trusted process. The loader then checks that it’s running from the user’s Downloads directory, contacts the staging server to retrieve PerfWatson2.exe, and creates a scheduled task named GoogleUpdaterTaskSystem140.0.7272.0 set to run at the highest available privileges on every user login.
“The combination of tools observed in this activity cluster reflects a pragmatic approach to tool selection and attack capabilities. The attackers behind this cluster continue to leverage common open-source tools such as SoftEther VPN and VNT to facilitate lateral movement.” concludes the report.”Our discovery of the TinyRCT backdoor in the attackers’ infrastructure underscores their ability to customize tools to gain specific capabilities.”
The use of off-the-shelf tools for most of the operation keeps attribution harder and development costs low, while the custom backdoor fills the specific gap those tools can’t cover: long-term, low-visibility persistence with a clean exit option. Unit 42 assesses this activity will continue and expand, with Southeast Asian energy and government organizations remaining the primary targets.
CL-STA-1062 continues to threaten Southeast Asia, particularly energy and government organizations, through attacks on critical infrastructure and the use of custom malware.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, China)
Mistic is the kind of backdoor that tells you the operator wants time, not noise. Symantec security researchers say it has shown up in financially motivated attacks against insurance, education, IT, and professional services firms, and they link it to KongTuke, also known as Woodgnat, an access broker active since at least 2024. That group has a clear business model: break in, hold the door open, and sell that access to ransomware crews like Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
The infection path looks built for camouflage. In the cases Symantec analyzed, the attack started when the legitimate MpExtMs.exe process loaded a malicious DLL named version.dll, which then dropped the Mistic loader, EndpointDlp.dll. The name looks close enough to Microsoft security tooling to be useful, and that’s probably the point. A separate .NET DLL also showed a fake login screen to steal credentials, because apparently criminals still enjoy borrowing your own trust against you.
“Mistic was side-loaded through MpExtMs.exe, a legitimate file, and loaded from a DLL named EndpointDlp.dll, a name associated with Microsoft endpoint-security tooling. This would help the backdoor blend in with trusted software.” reads the report published by Symantec. “The backdoor runs payloads in memory with no file written to disk and includes a kill switch that lets it delete itself, which are features consistent with an operator seeking long-term, low-visibility access.”
Symantec says Mistic has been used since April, and in at least one case it arrived right after ModeloRAT, another KongTuke-linked backdoor that has spread through Microsoft Teams social engineering. That sort of sequencing is not subtle, but it works often enough that people keep doing it.
Once loaded, Mistic connects to its command-and-control server and waits for instructions. It can upload, download, move, rename, delete files, create folders, change how often it checks in, run code directly in memory, and remove itself from the host. That’s a decent toolbox for a backdoor that’s trying not to look like one.
Zscaler first analyzed the backdoor tracks the same malware family as MTLBackdoor and says it was delivered in a multi-stage ClickFix chain in May.
“A relatively new backdoor that we have called Backdoor.Mistic has been deployed in multiple attacks since April 2026. The backdoor was first documented by Zscaler (which tracks it as MLTBackdoor) earlier this month.” continues the report. “Mistic may be linked to the financially motivated initial access broker (IAB) tracked publicly as KongTuke (which we track as Woodgnat) and it was used in one intrusion that also involved the group’s ModeloRAT remote access trojan.”
Mistic can upload, download, move, delete files, create folders, adjust command-check intervals, and even remove itself through a built-in kill switch. In a recent attack, attackers used DLL sideloading with a legitimate Microsoft executable to load the malware and a credential-stealing component that displayed a fake login screen. The campaign also leveraged common tools such as PowerShell, Curl, Certutil, WMIC, Net.exe and Reg.exe for reconnaissance, persistence, credential theft and lateral movement. Its in-memory execution and self-deletion capabilities make it particularly effective for long-term covert access.
“The fact that Mistic executes in memory and also has a kill switch built in means that it is very stealthy, potentially allowing for long-term, stealthy access for attackers.” continues the report.
KongTuke has also been seen using a wider kit, including WinPython, Node.js, finger.exe, a fake NexShield browser extension, the encrypted GateKeeper .NET payload, and loaders like MintsLoader and D3F@ck Loader. That mix matters because it shows an operator who values flexibility and wants to swap delivery methods fast. In other words, they’re not married to one trick, which is usually a bad sign for the people on the receiving end.
The growing use of custom malware in ransomware operations marks a shift from traditional reliance on legitimate system tools. Backdoor.Mistic appears to fit this trend and is likely developed by access brokers linked to ransomware affiliates rather than a ransomware gang itself. Its stealth features, along with Woodgnat’s suspected role in developing ModeloRAT, highlight a highly skilled group that could expand both its toolset and criminal partnerships.
“The stealth of the backdoor is also notable, as is the fact that Woodgnat is also possibly behind the development of ModeloRAT, indicating a group that is quite highly skilled at the development of stealthy remote access tools.” concludes the report. “This indicates it is a group that should be actively tracked as it could continue to develop custom tools, as well as widen the pool of ransomware actors it works with.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ransomware)
Entrar
